File name: | HMA Checker &_40; WORK 100_&_41;.rar |
Full analysis: | https://app.any.run/tasks/114ecf3c-0814-4514-9c37-affc82660f43 |
Verdict: | Malicious activity |
Analysis date: | November 08, 2018, 14:13:58 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v4, os: Win32 |
MD5: | 4AC039D524B2A6D798CB7654F9147BC7 |
SHA1: | 9141642AD263499A49AB9EE84ACA9B798D10C063 |
SHA256: | A0CD46C4CB3E105570F25639CC4D8EBAFA38C6E6A88AF97C84F29E40E728C9C0 |
SSDEEP: | 12288:sP9ipFqjOT/lZ5wwhk38juNbcXGIniYgLK8yh:+9ipFqKzj5wwhosuNbWMS8yh |
.rar | | | RAR compressed archive (v-4.x) (58.3) |
---|---|---|
.rar | | | RAR compressed archive (gen) (41.6) |
ArchivedFileName: | HMA Checker ( WORK 100%)\HMA Cracker.exe |
---|---|
PackingMethod: | Normal |
ModifyDate: | 2017:09:28 09:50:05 |
OperatingSystem: | Win32 |
UncompressedSize: | 913408 |
CompressedSize: | 200393 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3708 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\HMA Checker &_40; WORK 100_&_41;.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
908 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
3112 | "C:\Users\admin\Desktop\HMA Checker ( WORK 100%)\HMA Cracker.exe" | C:\Users\admin\Desktop\HMA Checker ( WORK 100%)\HMA Cracker.exe | explorer.exe | |
User: admin Company: FurkanYILDIRIM.Com.TR Integrity Level: MEDIUM Description: HideMyAss Cracker Version: 1.0.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3708 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3708.46711\HMA Checker ( WORK 100%)\New Text Document (2).txt | text | |
MD5:E5F0AFC901DC332E848800A75A5B4993 | SHA256:8F63AD86018B21BACB573BFDFB0C48F941F127EE7E7878E3F27FC36D0EB6EA21 | |||
3708 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3708.46711\HMA Checker ( WORK 100%)\HMA Cracker.exe | executable | |
MD5:948E2A4154AF822FF42CD140504583A8 | SHA256:92BE25220ED80A36B586A61D7BC79EF440AFDAEC592300D5BEDC53BCFF11D185 | |||
3708 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3708.46711\HMA Checker ( WORK 100%)\MetroFramework.Fonts.dll | executable | |
MD5:B8C8A532438C4B421081EFB258355469 | SHA256:15A605129CAC3663BA1DDB98F5798334FBA5E7954EE36A69727299B4E366C2EB | |||
3708 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3708.46711\HMA Checker ( WORK 100%)\MetroFramework.dll | executable | |
MD5:B20F1B5E3D4E3DF2D826E9870637CD06 | SHA256:9E58F13DEB328455F216F165588B5F5111ECD12042D7DD196686DFB0F0FC68EB | |||
3708 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3708.46711\HMA Checker ( WORK 100%)\MetroFramework.Design.dll | executable | |
MD5:C853E9E8C720249198FF376F42328EF9 | SHA256:28089707733C92C7FADE97E7B6FAB4007E7B8BFD6DC7A8526A3EA597F1A30845 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3112 | HMA Cracker.exe | 5.62.36.66:443 | mobile.api.hmageo.com | AVAST Software s.r.o. | CZ | unknown |
Domain | IP | Reputation |
---|---|---|
mobile.api.hmageo.com |
| unknown |